Mysterious letters from two banks. Should I be worried?

Determining if it is a scam:

• Look back at the contact phone number on the letter. Are you confident that it is correct? Scammers may use a phone number that is only one or two digits off from the bank's actual phone number, taking the chance that people will fall for it.
• Go back to literally any papers that you have received that you definitely know are from either bank. If there is anything different in regards to formatting, wording, etc., then there is a good chance that the letter is not genuine.
• Contact the bank from their official website and confirm that there isn't any unusual activity on your accounts (which you seem to have already done). If there is nothing in their system about the letter, then it is most likely not from them.

On the off chance that it is not a scam:

Are you sure that your wife is not associated with your bank account at all? Some banks encourage you to have a POD (Pay on Death) for your account, so maybe you did this at some point and forgot about it? (Plus, maiden names are a common piece of info that a bank may have, so that's not super unusual.)

I suspect this is part of a larger scam.

Soon you will get another letter saying something like "You have not fixed the matter we described in our previous letter. The matter is now urgent, and you will have to go directly to our web site to fix it."

And this time they will give you a link or QR code.

It is normal for a bank to send a letter when certain settings are changed by "you", this is to make sure that the owner of the account knows the settings have been changed. That letter should have all the logos and trademarks you expect.

It is good that you used a source that was not included on the letter to find the contact info for the bank.

That letter should have have enough info regarding the request that triggered it, but if the bank doesn't know why it was sent then it becomes highly suspect.

the letter is addressed to both me and my wife, using her former name. As far as I know, BofA is not even aware that my wife exists, and certainly does not know her former name.

While this could be a red flag, it might not be. I am always amazed how well the companies can make linkages. Their access to credit information can give them enough info to connect people that are in the same household. Of course the scammer might have enough info to also make the same linkage.

Ask the banks what you need to do to secure your account. This could be new passwords, or some additional security placed on the account. Check your credit history to see if they have succeeded in opening new accounts. Check all your financial accounts.

There are three likely possibilities here:

1. The letter is legitimate. The reference to an "inquiry" is something you forgot asking, or you are misunderstanding what they are talking about. From what you say, this option is unlikely, but possible.

2. Someone else is making inquiries to the bank in your name. Maybe applying for a loan using your credit rating or using your account as collateral, or trying to withdraw money from your account.

3. It's a phishing scam. The number is not really the bank's number. You call them and they ask you for account information, then use that information to steal money from your account.

So first step is to find out if the letter really came from the bank. Get the bank's phone number from some other source -- like your statement or their web site. Call them and ask if they sent this letter. If they say yes, ask for clarification what it's about and go from there. If they say no, then it must be some sort of scam.

I follow a simple practice: If I get a letter or email claiming to be from my bank (or whatever), I don't call the number on the letter. I look up the number somewhere else.

If the letter is not from the bank, I'd call the bank and ask them what you should do. Banks are usually very concerned about scams and they usually have procedures in place.

I've had 3 times that I've had fraudulent charges on my credit card. The first time, many years ago, the credit card company told me that I should call the vendor and get them to reverse the charge. I said, But it's totally fake, I never had any transaction with these people. You're telling me that I have to talk to a thief and convince him to give me back my money? The credit card company's answer came down to "Yes." I cancelled that card and never did business with them again.

The second time, the credit card company responded aggressively. They promptly canceled my card and sent me a new card with a new number, and then for the next few weeks they sent me a letter every week listing every transaction that came in against the old card and asked me to notify them if any of them were fraudulent.

The third time was a little ambiguous -- company claimed I signed up for a monthly subscription, and I couldn't swear I'd never done business with them. So the credit card company just blocked future transactions from that company and I ate the loss on the past ones. (It was like $20 a month, not an amount that would ruin me.)

One aspect that is not always considered is "paper phishing" used in combination with identity verification testing. Criminals sometimes send letters that look legitimate, just to see who responds, and to verify that certain addresses are active. The odd details, such as a past married name for your wife, indicate they are cross-referencing publicly available information, or earlier breaches. Even if they cannot get into any of your accounts right now, they are verifying which households they can likely collect information further, or later target.

Things you could do:

1. Document all correspondence: keep copy of all letters, with date and other details
2. Verify the list: you may want to call the banks themselves, not the number from the letter, just to verify it is a genuine communication.
3. Strengthen your identity security: you could consider a fraud alert, or credit freeze, especially if multiple banks are involved
4. Report to USPS: report the correspondence to USPS (or your local postal authority) as mail fraud.

Whether or not this is an immediate threat to your accounts, you can assume there is an attempt at some level intelligence gathering, and take proactive steps to protect your identity.